GCC Code Coverage Report
Directory: ./ Exec Total Coverage
File: lib/libcrypto/ocsp/ocsp_vfy.c Lines: 88 208 42.3 %
Date: 2017-11-13 Branches: 42 140 30.0 %

Line Branch Exec Source
1
/* $OpenBSD: ocsp_vfy.c,v 1.15 2017/01/29 17:49:23 beck Exp $ */
2
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
3
 * project 2000.
4
 */
5
/* ====================================================================
6
 * Copyright (c) 2000-2004 The OpenSSL Project.  All rights reserved.
7
 *
8
 * Redistribution and use in source and binary forms, with or without
9
 * modification, are permitted provided that the following conditions
10
 * are met:
11
 *
12
 * 1. Redistributions of source code must retain the above copyright
13
 *    notice, this list of conditions and the following disclaimer.
14
 *
15
 * 2. Redistributions in binary form must reproduce the above copyright
16
 *    notice, this list of conditions and the following disclaimer in
17
 *    the documentation and/or other materials provided with the
18
 *    distribution.
19
 *
20
 * 3. All advertising materials mentioning features or use of this
21
 *    software must display the following acknowledgment:
22
 *    "This product includes software developed by the OpenSSL Project
23
 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24
 *
25
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26
 *    endorse or promote products derived from this software without
27
 *    prior written permission. For written permission, please contact
28
 *    licensing@OpenSSL.org.
29
 *
30
 * 5. Products derived from this software may not be called "OpenSSL"
31
 *    nor may "OpenSSL" appear in their names without prior written
32
 *    permission of the OpenSSL Project.
33
 *
34
 * 6. Redistributions of any form whatsoever must retain the following
35
 *    acknowledgment:
36
 *    "This product includes software developed by the OpenSSL Project
37
 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38
 *
39
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
43
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50
 * OF THE POSSIBILITY OF SUCH DAMAGE.
51
 * ====================================================================
52
 *
53
 * This product includes cryptographic software written by Eric Young
54
 * (eay@cryptsoft.com).  This product includes software written by Tim
55
 * Hudson (tjh@cryptsoft.com).
56
 *
57
 */
58
59
#include <openssl/ocsp.h>
60
#include <openssl/err.h>
61
#include <string.h>
62
63
static int ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs,
64
    STACK_OF(X509) *certs, X509_STORE *st, unsigned long flags);
65
static X509 *ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id);
66
static int ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain,
67
    unsigned long flags);
68
static int ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret);
69
static int ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,
70
    STACK_OF(OCSP_SINGLERESP) *sresp);
71
static int ocsp_check_delegated(X509 *x, int flags);
72
static int ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req,
73
    X509_NAME *nm, STACK_OF(X509) *certs, X509_STORE *st,
74
    unsigned long flags);
75
76
/* Verify a basic response message */
77
int
78
OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs, X509_STORE *st,
79
    unsigned long flags)
80
{
81
8
	X509 *signer, *x;
82
	STACK_OF(X509) *chain = NULL;
83
	STACK_OF(X509) *untrusted = NULL;
84
4
	X509_STORE_CTX ctx;
85
	int i, ret = 0;
86
87
4
	ret = ocsp_find_signer(&signer, bs, certs, st, flags);
88
4
	if (!ret) {
89
		OCSPerror(OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND);
90
		goto end;
91
	}
92

4
	if ((ret == 2) && (flags & OCSP_TRUSTOTHER))
93
		flags |= OCSP_NOVERIFY;
94
4
	if (!(flags & OCSP_NOSIGS)) {
95
		EVP_PKEY *skey;
96
97
4
		skey = X509_get_pubkey(signer);
98
4
		if (skey) {
99
4
			ret = OCSP_BASICRESP_verify(bs, skey, 0);
100
4
			EVP_PKEY_free(skey);
101
4
		}
102
4
		if (!skey || ret <= 0) {
103
			OCSPerror(OCSP_R_SIGNATURE_FAILURE);
104
			goto end;
105
		}
106
4
	}
107
4
	if (!(flags & OCSP_NOVERIFY)) {
108
		int init_res;
109
110
4
		if (flags & OCSP_NOCHAIN) {
111
			untrusted = NULL;
112
4
		} else if (bs->certs && certs) {
113
			untrusted = sk_X509_dup(bs->certs);
114
			for (i = 0; i < sk_X509_num(certs); i++) {
115
				if (!sk_X509_push(untrusted,
116
					sk_X509_value(certs, i))) {
117
					OCSPerror(ERR_R_MALLOC_FAILURE);
118
					goto end;
119
				}
120
			}
121
		} else
122
			untrusted = bs->certs;
123
4
		init_res = X509_STORE_CTX_init(&ctx, st, signer, untrusted);
124
4
		if (!init_res) {
125
			ret = -1;
126
			OCSPerror(ERR_R_X509_LIB);
127
			goto end;
128
		}
129
130
8
		if (X509_STORE_CTX_set_purpose(&ctx,
131
4
		    X509_PURPOSE_OCSP_HELPER) == 0) {
132
			X509_STORE_CTX_cleanup(&ctx);
133
			ret = -1;
134
			goto end;
135
		}
136
4
		ret = X509_verify_cert(&ctx);
137
4
		chain = X509_STORE_CTX_get1_chain(&ctx);
138
4
		X509_STORE_CTX_cleanup(&ctx);
139
4
		if (ret <= 0) {
140
			i = X509_STORE_CTX_get_error(&ctx);
141
			OCSPerror(OCSP_R_CERTIFICATE_VERIFY_ERROR);
142
			ERR_asprintf_error_data("Verify error:%s",
143
			    X509_verify_cert_error_string(i));
144
			goto end;
145
		}
146
4
		if (flags & OCSP_NOCHECKS) {
147
			ret = 1;
148
			goto end;
149
		}
150
		/* At this point we have a valid certificate chain
151
		 * need to verify it against the OCSP issuer criteria.
152
		 */
153
4
		ret = ocsp_check_issuer(bs, chain, flags);
154
155
		/* If fatal error or valid match then finish */
156
4
		if (ret != 0)
157
4
			goto end;
158
159
		/* Easy case: explicitly trusted. Get root CA and
160
		 * check for explicit trust
161
		 */
162
		if (flags & OCSP_NOEXPLICIT)
163
			goto end;
164
165
		x = sk_X509_value(chain, sk_X509_num(chain) - 1);
166
		if (X509_check_trust(x, NID_OCSP_sign, 0) !=
167
			X509_TRUST_TRUSTED) {
168
			OCSPerror(OCSP_R_ROOT_CA_NOT_TRUSTED);
169
			goto end;
170
		}
171
		ret = 1;
172
	}
173
174
end:
175
4
	if (chain)
176
4
		sk_X509_pop_free(chain, X509_free);
177
4
	if (bs->certs && certs)
178
		sk_X509_free(untrusted);
179
4
	return ret;
180
4
}
181
182
static int
183
ocsp_find_signer(X509 **psigner, OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
184
    X509_STORE *st, unsigned long flags)
185
{
186
	X509 *signer;
187
8
	OCSP_RESPID *rid = bs->tbsResponseData->responderId;
188
189
4
	if ((signer = ocsp_find_signer_sk(certs, rid))) {
190
		*psigner = signer;
191
		return 2;
192
	}
193

8
	if (!(flags & OCSP_NOINTERN) &&
194
4
	    (signer = ocsp_find_signer_sk(bs->certs, rid))) {
195
4
		*psigner = signer;
196
4
		return 1;
197
	}
198
	/* Maybe lookup from store if by subject name */
199
200
	*psigner = NULL;
201
	return 0;
202
4
}
203
204
static X509 *
205
ocsp_find_signer_sk(STACK_OF(X509) *certs, OCSP_RESPID *id)
206
{
207
	int i;
208
16
	unsigned char tmphash[SHA_DIGEST_LENGTH], *keyhash;
209
	X509 *x;
210
211
	/* Easy if lookup by name */
212
8
	if (id->type == V_OCSP_RESPID_NAME)
213
8
		return X509_find_by_subject(certs, id->value.byName);
214
215
	/* Lookup by key hash */
216
217
	/* If key hash isn't SHA1 length then forget it */
218
	if (id->value.byKey->length != SHA_DIGEST_LENGTH)
219
		return NULL;
220
	keyhash = id->value.byKey->data;
221
	/* Calculate hash of each key and compare */
222
	for (i = 0; i < sk_X509_num(certs); i++) {
223
		x = sk_X509_value(certs, i);
224
		X509_pubkey_digest(x, EVP_sha1(), tmphash, NULL);
225
		if (!memcmp(keyhash, tmphash, SHA_DIGEST_LENGTH))
226
			return x;
227
	}
228
	return NULL;
229
8
}
230
231
static int
232
ocsp_check_issuer(OCSP_BASICRESP *bs, STACK_OF(X509) *chain,
233
    unsigned long flags)
234
{
235
	STACK_OF(OCSP_SINGLERESP) *sresp;
236
	X509 *signer, *sca;
237
8
	OCSP_CERTID *caid = NULL;
238
	int i;
239
240
4
	sresp = bs->tbsResponseData->responses;
241
242
4
	if (sk_X509_num(chain) <= 0) {
243
		OCSPerror(OCSP_R_NO_CERTIFICATES_IN_CHAIN);
244
		return -1;
245
	}
246
247
	/* See if the issuer IDs match. */
248
4
	i = ocsp_check_ids(sresp, &caid);
249
250
	/* If ID mismatch or other error then return */
251
4
	if (i <= 0)
252
		return i;
253
254
4
	signer = sk_X509_value(chain, 0);
255
	/* Check to see if OCSP responder CA matches request CA */
256
4
	if (sk_X509_num(chain) > 1) {
257
4
		sca = sk_X509_value(chain, 1);
258
4
		i = ocsp_match_issuerid(sca, caid, sresp);
259
4
		if (i < 0)
260
			return i;
261
4
		if (i) {
262
			/* We have a match, if extensions OK then success */
263
4
			if (ocsp_check_delegated(signer, flags))
264
4
				return 1;
265
			return 0;
266
		}
267
	}
268
269
	/* Otherwise check if OCSP request signed directly by request CA */
270
	return ocsp_match_issuerid(signer, caid, sresp);
271
4
}
272
273
/* Check the issuer certificate IDs for equality. If there is a mismatch with the same
274
 * algorithm then there's no point trying to match any certificates against the issuer.
275
 * If the issuer IDs all match then we just need to check equality against one of them.
276
 */
277
static int
278
ocsp_check_ids(STACK_OF(OCSP_SINGLERESP) *sresp, OCSP_CERTID **ret)
279
{
280
	OCSP_CERTID *tmpid, *cid;
281
	int i, idcount;
282
283
8
	idcount = sk_OCSP_SINGLERESP_num(sresp);
284
4
	if (idcount <= 0) {
285
		OCSPerror(OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA);
286
		return -1;
287
	}
288
289
4
	cid = sk_OCSP_SINGLERESP_value(sresp, 0)->certId;
290
291
4
	*ret = NULL;
292
293
16
	for (i = 1; i < idcount; i++) {
294
4
		tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId;
295
		/* Check to see if IDs match */
296
4
		if (OCSP_id_issuer_cmp(cid, tmpid)) {
297
			return 0;
298
		}
299
	}
300
301
	/* All IDs match: only need to check one ID */
302
4
	*ret = cid;
303
4
	return 1;
304
4
}
305
306
static int
307
ocsp_match_issuerid(X509 *cert, OCSP_CERTID *cid,
308
    STACK_OF(OCSP_SINGLERESP) *sresp)
309
{
310
	/* If only one ID to match then do it */
311
8
	if (cid) {
312
		const EVP_MD *dgst;
313
		X509_NAME *iname;
314
		int mdlen;
315
4
		unsigned char md[EVP_MAX_MD_SIZE];
316
317
4
		if (!(dgst =
318
4
		    EVP_get_digestbyobj(cid->hashAlgorithm->algorithm))) {
319
			OCSPerror(OCSP_R_UNKNOWN_MESSAGE_DIGEST);
320
			return -1;
321
		}
322
323
4
		mdlen = EVP_MD_size(dgst);
324
4
		if (mdlen < 0)
325
			return -1;
326

8
		if (cid->issuerNameHash->length != mdlen ||
327
4
		    cid->issuerKeyHash->length != mdlen)
328
			return 0;
329
4
		iname = X509_get_subject_name(cert);
330
4
		if (!X509_NAME_digest(iname, dgst, md, NULL))
331
			return -1;
332
4
		if (memcmp(md, cid->issuerNameHash->data, mdlen))
333
			return 0;
334
4
		X509_pubkey_digest(cert, dgst, md, NULL);
335
4
		if (memcmp(md, cid->issuerKeyHash->data, mdlen))
336
			return 0;
337
338
4
		return 1;
339
4
	} else {
340
		/* We have to match the whole lot */
341
		int i, ret;
342
		OCSP_CERTID *tmpid;
343
344
		for (i = 0; i < sk_OCSP_SINGLERESP_num(sresp); i++) {
345
			tmpid = sk_OCSP_SINGLERESP_value(sresp, i)->certId;
346
			ret = ocsp_match_issuerid(cert, tmpid, NULL);
347
			if (ret <= 0)
348
				return ret;
349
		}
350
		return 1;
351
	}
352
4
}
353
354
static int
355
ocsp_check_delegated(X509 *x, int flags)
356
{
357
8
	X509_check_purpose(x, -1, 0);
358

8
	if ((x->ex_flags & EXFLAG_XKUSAGE) && (x->ex_xkusage & XKU_OCSP_SIGN))
359
4
		return 1;
360
	OCSPerror(OCSP_R_MISSING_OCSPSIGNING_USAGE);
361
	return 0;
362
4
}
363
364
/* Verify an OCSP request. This is fortunately much easier than OCSP
365
 * response verify. Just find the signers certificate and verify it
366
 * against a given trust value.
367
 */
368
int
369
OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *store,
370
    unsigned long flags)
371
{
372
	X509 *signer;
373
	X509_NAME *nm;
374
	GENERAL_NAME *gen;
375
	int ret;
376
	X509_STORE_CTX ctx;
377
378
	if (!req->optionalSignature) {
379
		OCSPerror(OCSP_R_REQUEST_NOT_SIGNED);
380
		return 0;
381
	}
382
	gen = req->tbsRequest->requestorName;
383
	if (!gen || gen->type != GEN_DIRNAME) {
384
		OCSPerror(OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE);
385
		return 0;
386
	}
387
	nm = gen->d.directoryName;
388
	ret = ocsp_req_find_signer(&signer, req, nm, certs, store, flags);
389
	if (ret <= 0) {
390
		OCSPerror(OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND);
391
		return 0;
392
	}
393
	if ((ret == 2) && (flags & OCSP_TRUSTOTHER))
394
		flags |= OCSP_NOVERIFY;
395
	if (!(flags & OCSP_NOSIGS)) {
396
		EVP_PKEY *skey;
397
398
		skey = X509_get_pubkey(signer);
399
		ret = OCSP_REQUEST_verify(req, skey);
400
		EVP_PKEY_free(skey);
401
		if (ret <= 0) {
402
			OCSPerror(OCSP_R_SIGNATURE_FAILURE);
403
			return 0;
404
		}
405
	}
406
	if (!(flags & OCSP_NOVERIFY)) {
407
		int init_res;
408
409
		if (flags & OCSP_NOCHAIN)
410
			init_res = X509_STORE_CTX_init(&ctx, store, signer,
411
			    NULL);
412
		else
413
			init_res = X509_STORE_CTX_init(&ctx, store, signer,
414
			    req->optionalSignature->certs);
415
		if (!init_res) {
416
			OCSPerror(ERR_R_X509_LIB);
417
			return 0;
418
		}
419
420
		if (X509_STORE_CTX_set_purpose(&ctx,
421
		      X509_PURPOSE_OCSP_HELPER) == 0 ||
422
		    X509_STORE_CTX_set_trust(&ctx,
423
		      X509_TRUST_OCSP_REQUEST) == 0) {
424
			X509_STORE_CTX_cleanup(&ctx);
425
			return 0;
426
		}
427
		ret = X509_verify_cert(&ctx);
428
		X509_STORE_CTX_cleanup(&ctx);
429
		if (ret <= 0) {
430
			ret = X509_STORE_CTX_get_error(&ctx);
431
			OCSPerror(OCSP_R_CERTIFICATE_VERIFY_ERROR);
432
			ERR_asprintf_error_data("Verify error:%s",
433
			    X509_verify_cert_error_string(ret));
434
			return 0;
435
		}
436
	}
437
	return 1;
438
}
439
440
static int
441
ocsp_req_find_signer(X509 **psigner, OCSP_REQUEST *req, X509_NAME *nm,
442
    STACK_OF(X509) *certs, X509_STORE *st, unsigned long flags)
443
{
444
	X509 *signer;
445
446
	if (!(flags & OCSP_NOINTERN)) {
447
		signer = X509_find_by_subject(req->optionalSignature->certs, nm);
448
		if (signer) {
449
			*psigner = signer;
450
			return 1;
451
		}
452
	}
453
454
	signer = X509_find_by_subject(certs, nm);
455
	if (signer) {
456
		*psigner = signer;
457
		return 2;
458
	}
459
	return 0;
460
}